Now Available: pfSense® Plus 25.07-RELEASE
-
Curious what hardware you were updating?
-
After cruising along at 180 days+ of uptime on 24.11, I decided to move ahead and upgrade to 25.07 this evening. Upgrade went flawless and probably took around 5 minutes on a Xeon D-1718T based system. Happy to see Unbound 1.23 included (there were some bug fixes in that release related to serve expired that I was looking forward to) as well as reduced CPU usage when viewing the dashboard page.
Thanks to everyone at Netgate for all your hard work on this release!
-
Anyone knows why this has come up - SG-2100 - took 20 mins to get past - I thought it was locked up - one Acme *.domain cert only ? This was upgrade and fresh.
[48/72] Extracting ca_root_nss-3.104_1: ....... done
certctl: Skipping untrusted certificate 57bcb2da (/etc/ssl/untrusted/57bcb2da.0)
certctl: Skipping untrusted certificate 08063a00 (/etc/ssl/untrusted/08063a00.0)
certctl: Skipping untrusted certificate 5e98733a (/etc/ssl/untrusted/5e98733a.0)
certctl: Skipping untrusted certificate 18856ac4 (/etc/ssl/untrusted/18856ac4.0)
certctl: Skipping untrusted certificate 5e98733a (/etc/ssl/untrusted/5e98733a.0)
certctl: Skipping untrusted certificate 18856ac4 (/etc/ssl/untrusted/18856ac4.0)
certctl: Skipping untrusted certificate 08063a00 (/etc/ssl/untrusted/08063a00.0)
certctl: Skipping untrusted certificate 57bcb2da (/etc/ssl/untrusted/57bcb2da.0)
[49/72] Upgrading php83-sqlite3 from 8.3.12 to 8.3.19...
[49/72] Extracting php83-sqlite3-8.3.19: ......... done -
@kymmitsu The short answer is, that’s “normal” and it takes a while to chunk through that step on the 1100/2100’s CPU. Or similar; the 2220 I updated through a few versions to 24.11 recently took around 25-30m for each update + reboot.
pfBlocker also took what seemed like 10 minutes to install on a 2100 last night.
The “skip” lines are normal also.
-
Yeah my vm took took quite some time to get through the certs when it updated the nss package - I was starting to get a bit worried myself that something was going on.. But its a very low powered vm, only 1 cpu and only 512MB of ram.. And running on a NAS, so its not a rocketship by any means.
My sg4860 did better, but it still took a few minutes to get through that.
Wonder if might be a good idea to add to release notes, but then again doesn't seem like everyone reads those before clicking update anyway ;)
-
Upgraded multiple XG7100, 6100 and one SG1100 without any issue.
-
Upgraded a 1100 from 25.03-BETA to 25.07-RELEASE from within the GUI, no issues.
-
Updated without any problems (non Netgate Hardware)
Thank you for this update
-
Just for some feedback in case anyone else encounters this, I had an unexpected issue during my upgrade from 24.11 to 25.07.
Everything went OK, and then the Firewall went down for reboot. 10 mins later, still no Firewall. 20 mins later it came back, but on 24.11.
So I tried again and stuck a console output on my hardware. The OS loads 25.07, but gets stuck at updating configuration.........for what feels like forever. After 900 seconds, xmlparse.int throws an error and it reboots back into 24.11.
This odd issue was caused by bloated backups in the /var directory. I had mine set to purge every 30 days, but it doesn't seem to have been doing it - so unbeknown to me, I had 10G worth of backups and it was chocking the xmlparse.init file on upgrade.
I cleared out most of the backups (it went back a year), tried the update again and it went through smoothly.
Just thought I'd share if anyone else found any problems.
-
@crucialguy That’s a bug in 24.* but if you go to the config history page it will prune them out, but the page will probably time out before it does.
-
After upgrade I noticed few things that stopped working for me.
-
Avahi logs show that all has started fine but apple mirroring or airplay does not work anymore. System logs shows that Ahavi started on selected subnets but I do not think that it makes necessary changes to IP tables and enable cross subnet communication.
-
Enabling KEA DHCP works but some LG TV clients would not "auto connect". (my Unbound DNS is on different host). To get it to connect I have to disable "auto connect" and configure TV to use static IP.
-
-
@markster said in Now Available: pfSense
Plus 25.07-RELEASE:System logs shows that Ahavi started on selected subnets but I do not think that it makes necessary changes to IP tables and enable cross subnet communication.
Avahi does not make firewall rule changes, and no changes are necessary for Avahi to function with the default set of firewall rules. This has been the case for many, many years.
It's possible to break Avahi functionality If you specifically add rules to block inbound mDNS traffic to firewall interfaces, but that would be a conscious act.
-
@dennypage since I know airprint sends to multicast address 224.0.0.251, I would assume airplay does the same for discovery via mdns - I have never bothered to look that deep into them when did testing bfore for other threads on how to validate mdns is being passed on. But options might be set. Which would be blocked now unless rule set to allow them.
If that is the case - I would have to test, but its late here - then yeah it could be blocked now without conscious act to allow.
But yeah normally if the interface has an allow rule for internet which normally destination any avahi would pass on the mdns to where you set it to go. But with multicast with options set being blocked in recent versions, maybe you would now have to allow for options in your allow rule?
I can test in the morning - I am not a fan or user of avahi, not really a fan of breaking L2 barrier.. I just put my printer that uses airprint on the network my wifi clients use that would want to airprint to that printer. Still not a fan of apple not letting you just setting an IP on ios vs having to discover the printer. My other devices that need to talk to printer from other networks, just set the IP/FQDN of the printer to print to it.
But if it use to work, and now doesn't after an upgrade to pfsense the options on multicast would be my guess.
-
@johnpoz said in Now Available: pfSense
Plus 25.07-RELEASE:@dennypage since I know airprint sends to multicast address 224.0.0.251, I would assume airplay does the same for discovery via mdns - I have never bothered to look that deep into them when did testing bfore for other threads on how to validate mdns is being passed on. But options might be set. Which would be blocked now unless rule set to allow them.
If that is the case - I would have to test, but its late here - then yeah it could be blocked now without conscious act to allow.mDNS packets do not have options set. And remember, by default pfSense has always dropped packets with options set — it’s just that the drops were silent until 24.x.
The issue regarding multicast with options is with IGMP, which requires the router alert option.
-
@dennypage true - they did always drop before. When I have tested this I always created a floating to rule to make sure 224.0.0.251 was for sure allowed. But all good points.
-
@dennypage I did not made any changes just enable Avahi on the 2 interfaces. It is always been like that.
Anyway, I decided to make things easier without Avahi and place both TV's on the same segment as my AP router. AP router has 4 Ethernet ports so it can act as AP and a switch. All working good. -
@markster said in Now Available: pfSense
Plus 25.07-RELEASE:to make things easier without Avahi and place both TV's on the same segment as my AP router.
There you go.. I personally think that is a much better solution - and requires no breaking of the L2 barrier. mdns was never meant to cross networking boundaries.
-
Upgraded from 24.11 to 25.07 on our spare Netgate 7100 unit. We always do this for testing, and so far it looks good.
But after the upgrade monitoring complains:
SWAP CRITICAL - 0% free (0 MB out of 0 MB) - Swap is either disabled, not present, or of zero size.And monitoring is probably right, since there seems to be no more swapspace after the upgrade:
[25.07-RELEASE][admin@spare7100]/root: swapinfo
Device 1K-blocks Used Avail CapacityOn my other units which still are on 24.11 I get:
/dev/ada0p2 1048576 0 1048576 0%
/dev/ada1p2 1048576 0 1048576 0%On my upgraded box /etc/fstab still has the entries for swapspace:
Device Mountpoint FStype Options Dump Pass#
/dev/ada0p2 none swap sw 0 0
/dev/ada1p2 none swap sw 0 0When I run 'swapon -a' on command-line, the swap activates and monitoring turns green once more.
Is this intended to be this way, or a bug maybe, or just bad luck this boot ?
Tomorrow I can try another reboot, see what happens then.
Jos Andel
-
Nope that's not expected. SWAP should be enabled by default if it's present. Are you running UFS or ZFS?
-
@stephenw10
We are running on zfs. Today I rebooted to test if I could reproduce it, after this reboot still no swapspace and another alert in the monitoring. So looks like reproducable.Thanks, Jos
